TypedArray.prototype.set uses internal length property, not real one.

test/mjsunit/es6/typedarray-set-length-internal.js

Index: test/mjsunit/es6/typedarray-set-length-internal.js
diff --git a/test/mjsunit/es6/typedarray-set-length-internal.js b/test/mjsunit/es6/typedarray-set-length-internal.js
new file mode 100644
index 0000000000000000000000000000000000000000..22b8f67e0ee454b37605dd9342339b447a9a1703
--- /dev/null
+++ b/test/mjsunit/es6/typedarray-set-length-internal.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+var descriptor = { get: function() { throw new Error("accessed length"); } };
+
+for (var constructor of typedArrayConstructors) {
+  var differentConstructor =
+    constructor === Uint8Array ? Int8Array : Uint8Array;
+  var target = new constructor(16);
+  Object.defineProperty(target, "length", descriptor);
+
+  var sameBuffer = new differentConstructor(target.buffer, 0, 2);
+  Object.defineProperty(sameBuffer, "length", descriptor);
+  target.set(sameBuffer);
+
+  var differentBuffer = new differentConstructor(16);
+  Object.defineProperty(differentBuffer, "length", descriptor);
+  target.set(differentBuffer);
+
+  var array = [0, 1, 2];
+  target.set(array);
+}